diff --git a/docs/_includes/themes/zeppelin/_navigation.html b/docs/_includes/themes/zeppelin/_navigation.html index acaa89d908c..18c1c74561c 100644 --- a/docs/_includes/themes/zeppelin/_navigation.html +++ b/docs/_includes/themes/zeppelin/_navigation.html @@ -96,7 +96,6 @@
  • Configuration API
    • -
  • Security Overview
  • Authentication for NGINX
  • Shiro Authentication
  • Notebook Authorization
    • diff --git a/docs/assets/themes/zeppelin/img/docs-img/insufficient_privileges.png b/docs/assets/themes/zeppelin/img/docs-img/insufficient_privileges.png new file mode 100644 index 00000000000..80d80f5efd8 Binary files /dev/null and b/docs/assets/themes/zeppelin/img/docs-img/insufficient_privileges.png differ diff --git a/docs/assets/themes/zeppelin/img/docs-img/permission_setting.png b/docs/assets/themes/zeppelin/img/docs-img/permission_setting.png new file mode 100644 index 00000000000..ed8094183a2 Binary files /dev/null and b/docs/assets/themes/zeppelin/img/docs-img/permission_setting.png differ diff --git a/docs/security/interpreter_authorization.md b/docs/security/interpreter_authorization.md index 862ef9b828b..72cc5a2be72 100644 --- a/docs/security/interpreter_authorization.md +++ b/docs/security/interpreter_authorization.md @@ -33,4 +33,4 @@ The interpret method takes the user string as parameter and executes the jdbc ca In case of Presto, we don't need password if the Presto DB server runs backend code using HDFS authorization for the user. For databases like Vertica and Mysql we have to store password information for users. -The Credentials tab in the navbar allows users to save credentials for data sources which are passed to interpreters. \ No newline at end of file +The Credentials tab in the navbar allows users to save credentials for data sources which are passed to interpreters. diff --git a/docs/security/notebook_authorization.md b/docs/security/notebook_authorization.md index aafe0606241..34888ea6b4a 100644 --- a/docs/security/notebook_authorization.md +++ b/docs/security/notebook_authorization.md @@ -17,21 +17,39 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> -# Notebook Authorization +# Zeppelin Notebook Authorization -We assume that there is an authentication component that associates a user string and a set of group strings with every NotebookSocket. +We assume that there is an **Shiro Authentication** component that associates a user string and a set of group strings with every NotebookSocket. +If you don't set the authentication components yet, please check [Shiro authentication for Apache Zeppelin](./shiroauthentication.html) first. -Each note has the following: -* set of owner entities (users or groups) -* set of reader entities (users or groups) -* set of writer entities (users or groups) +## Authorization Setting +You can set Zeppelin notebook permissions in each notebooks. Of course only **notebook owners** can change this configuration. +Just click **Lock icon** and open the permission setting page in your notebook. -If a set is empty, it means that any user can perform that operation. +As you can see, each Zeppelin notebooks has 3 entities : -The NotebookServer classifies every Note operation into three categories: read, write, manage. -Before executing a Note operation, it checks if the user and the groups associated with the NotebookSocket have permissions. For example, before executing an read -operation, it checks if the user and the groups have at least one entity that belongs to the reader entities. +* Owners ( users or groups ) +* Readers ( users or groups ) +* Writers ( users or groups ) -To initialize and modify note permissions, we provide UI like "Interpreter binding". The user inputs comma separated entities for owners, readers and writers. -We execute a rest api call with this information. In the backend we get the user information for the connection and allow the operation if the user and groups -associated with the current user have at least one entity that belongs to owner entities for the note. +
    + +Fill out the each forms with comma seperated **users** and **groups** configured in `conf/shiro.ini` file. +If the form is empty (*), it means that any users can perform that operation. + +If someone who doesn't have **read** permission is trying to access the notebook or someone who doesn't have **write** permission is trying to edit the notebook, Zeppelin will ask to login or block the user. + +
    + +## How it works +In this section, we will explain the detail about how the notebook authorization works in backend side. + +#### NotebookServer +The [NotebookServer](https://github.com/apache/incubator-zeppelin/blob/master/zeppelin-server/src/main/java/org/apache/zeppelin/socket/NotebookServer.java) classifies every notebook operations into three categories: **Read**, **Write**, **Manage**. +Before executing a notebook operation, it checks if the user and the groups associated with the `NotebookSocket` have permissions. +For example, before executing a **Read** operation, it checks if the user and the groups have at least one entity that belongs to the **Reader** entities. + +#### Notebook REST API call +Zeppelin executes a [REST API call](https://github.com/apache/incubator-zeppelin/blob/master/zeppelin-server/src/main/java/org/apache/zeppelin/rest/NotebookRestApi.java) for the notebook permission information. +In the backend side, Zeppelin gets the user information for the connection and allows the operation if the users and groups +associated with the current user have at least one entity that belongs to owner entities for the notebook. diff --git a/docs/security/overview.md b/docs/security/overview.md deleted file mode 100644 index e76410d13cc..00000000000 --- a/docs/security/overview.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -layout: page -title: "Security Overview" -description: "Security Overview" -group: security ---- - -{% include JB/setup %} - -# Security Overview - -There are three aspects to Zeppelin security: - -* Authentication: is the user who they say they are? [More](authentication.html) -* Notebook authorization: does the user have permissions to read or write to a note? [More](notebook_authorization.html) -* Interpreter and data source authorization: does the user have permissions to perform interpreter operations or access data source objects? [More](interpreter_authorization.html)